🚀 go-pugleaf

I recently noticed that Diskreet from Norton Utilities promtly notified
me when I had entered the incorrect password to decrypt a file.  I then
began to think that a CRC of the password (or something of the sort) was
stored in the encrypted file.  It appears as if this is the case. I do not
know how the password is permutated, but I would hope that this is a
one-way algorithm.  However, it could be a reversible algorithm built by
Peter Norton in order to provide a trapdoor.

Here are the first 48 bytes from command.sec, command.com encrypted using
Diskreet with password: thisisatest

6718:0100  50 4E 43 49 43 52 59 50-54 00 01 00 00 00 01 00
6718:0110  42 7E 34 E0 B4 7A BE CC-69 E7 2D 93 F9 FD 4A D3
           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
6718:0120  43 36 90 98 5F EC 6A C9-BA 9F 43 2B 8E D6 2D 70

Here are the first 48 bytes from chkdsk.sec, chkdsk.com encrypted using
Diskreet with the same password (thisisatest)

6718:0100  50 4E 43 49 43 52 59 50-54 00 01 00 00 00 01 00
6718:0110  42 7E 34 E0 B4 7A BE CC-69 E7 2D 93 F9 FD 4A D3
           ^^^^^^^^^^^^^^^^^^^^^^^ ^^^^^^^^^^^^^^^^^^^^^^^
6718:0120  B1 C2 06 23 83 6C 5B E7-B1 95 F7 12 D6 F0 BB BA

Notice how the second line (bytes 10-1f) are the same in both cases!  The
actual encrypted text is apparently stored starting at byte 20.  Besides
the password, these files are absolutely unrelated.

Here is command.sec, command.com encrypted with a new password...

6718:0100  50 4E 43 49 43 52 59 50-54 00 01 00 00 00 01 00
6718:0110  BE A1 7B C1 F5 31 58 61-E2 C1 3D 5C BE 68 50 A9
6718:0120  53 F7 A7 09 CC BB 28 59-46 8B A0 20 05 A8 F1 DA

Notice that when I changed the password, bytes 10-1f also changed.  
Apparently
this is where the permutated password is stored.

Does anybody know what sort of routine Peter Norton uses here?  Is it
reversible?

- C Ruoho

--
Clint Ruoho    4042 East 2nd St     Tucson, AZ 85711-1012
cr@farpoint.tucson.az.us (preferred)
mink@coyote.datalog.com